CVE-2019-20388: Debian Linux

High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days.

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 30 only; version 31 only; version 32 only
• Netapp Cloud Backup: affected versions not specified
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Netapp Plug-In For Symantec Netbackup: affected versions not specified
• Netapp Smi-S Provider: affected versions not specified
• Netapp Snapdrive: affected versions not specified
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified
• Opensuse Leap: version 15.1 only
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
• Oracle Enterprise Manager Base Platform: version 13.4.0.0 only; version 13.5.0.0 only
• Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
• Oracle MySQL Workbench: up to and including 8.0.26
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only
• Oracle Real User Experience Insight: version 13.3.1.0 only; version 13.4.1.0 only; version 13.5.1.0 only
• Xmlsoft LIBXML2: version 2.9.10 only

Published 2020-01-21. Last modified 2026-06-17.